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We Claim : 

1. A method of selectively establishing read-only access to a volume of a 
storage-device, the method comprising: 

receiving an input/output request packet (IRP) that is traversing a stack 
of device objects representing a storage-device; 

determining the type of access being requested via the IRP; and 
selectively failing the IRP depending upon the requested-type of access. 

2. The method of claim 1, whereta the selectively falling step fails the IRP if 
the requested-type of access is something other than read-only access. 

3. The method of claun 1, the method further comprising: 
checking whether the IRP is of a type meriting scrutiny; and 

skipping the determining and selectively-failing steps if the IRP does not 
merit scrutiny. 

4. The method of claim 3, wherein: 

the checking step inspects whether the IRP includes the major function 
code IRP_MJ_CREATE; and 

the skipping step skips if the IRP does not Include IRP__MJ_CREATE. 

5. The method of claim 1, wherein 

the IRP includes one or more access fields representing the type of access 
to the volume being requested; and 

the determining step includes 

checking the one or more access fields for contents indicating that 
the type of access being requested is something other than read-only access. 

6. The method of claim 5, wherein: 

the checking step makes a logical combination of one or more bit values 
in the one or more access fields; and 
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the failing step fails the IRP if the result of the logical combination 
indicates something other than read-only access. 

7. A method of selectively restricting access to a volume of a storage-device, 
the method comprising: 

receiving a first input/output request packet (IRP) that is traversing a 

stack of device objects representing a storage-device; 

determining the type of access being requested via the first IRP; and 
selectively failing the first IRP according to a volimie-ID identified found 

in the IRP and the type of access requested by the IRP. 

8. The method of claim 7, wherein: 
the IRP is a first IRP; and 

the method further comprises: 

ascertaining whether the volume-ID for the pairticulsir volume on 
the storage- device which the stack represents has been obtained; 

generating and sending, if the volume-ID has not been obtained, a 
second IRP representing a request to obtain the volimie-ID; and 

receiving, in response to the second IRP, the volume-ID. 

9. The method of claim 7, wherein the selectively failing step does the 
following: 

checks the desired read-state of the volume based on the volume-ID, and 
fails the IRP if the desired read-state is read-only and the requested 
access is something other than read-only access. 

10. Hie method of claim 9. wherein the selectively failing step checks by 
comparing the volume-ID to a list of volume-IDs that are constrained to read- 
only access. 

11. The method of claim 7, the method further comprising: 
checking whether the IRP is of a type meriting scrutiny; and 
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skipping the determining and selectively-failing steps if the IRP does not 
merit scrutiny. 

12. The method of claim 11, wherein: 

the checking step inspects whether the IRP includes the major function 
code IRP_MJ_CREATE; and 

the skipping step skips if the IRP does not include IRP_MJ_CREATE. 

13. The method of claim 7, wherein 

the IRP includes one or more access fields representing a type of access 
to the volume being requested; and 

the determining step Includes 

inspecting the one or more access fields for contents indicating that 
the type of access being requested is something other than read-only access. 

14. The method of claim 13, wherein: 

the inspecting step makes a logical combination of one or more bit values 
m the one or more access fields. 

15. The method of claim 7, wherein 

the first IRP is received at a location in the stack represented by a device 
object; and 

the ascertaining step checks one or more bits in an unreserved area of 
the device object to ascertain whether the volume-ID has been obtained. 

16. The method of claim 7, wherein the volume-ID is the voliune label. 

17. A method of selectively establishing read-only access to a volume of a 
storage-device, the method comprising: 

receiving an input/output request packet (IRP) that is traversing a stack 
of device objects representing a storage-device; 

determining whether the received IRP is a set-status IRP for setting an 
operational status of a fUter to be one of ON or OFF; and 
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setting, if the IRP is a set-status IRP, the operational status of the filter 
according to the set-status IRP. 

18. The method of claim 17, wherein the determining step includes 
inspecting one or more bits in an unreserved area of the IRP to ascertain if the 
IRP is a set-status IRP. 

19. The method of claim 17, the method further comprising: 
checking whether the IRP is of a type meriting scrutiny; and 

skipping the determining and setting steps if the IRP does not merit 
scrutiny. 

20. The method of claim 19, wherein: 

the checking step Inspects whether the IRP includes the major function 
code IRP_MJ_CREATE; and 

the skipping step skips if the IRP does not include IRP_MJ_CREATE. 

21. The method of claim 17, wherein the filter examines an IRP for at least 
one of the following criteria: a type of access to the volume which the received 
IRP represents; and a volume-ID for the particular volume of the storage-device 
which the stack represents. 

22. The method of claim 17, wherein the setting step sets the operational 

status by toggling the operational status. 

23. The method of claim 17, wherein the setting step sets the operational status 
to be that of a desired operationaJ status identified in the IRP. 

24. A machine-readable medium including instructions execution of which 
by a machine selectively establishes read-only access to a volume of a storage- 
device, the machine-readable instructions comprising: 

a code segment for receiving an input/output request packet (IRP) that is 
traversing a stack of device objects representing a storage-device; 
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a code segment for determining the type of access being requested via the 
IRP; and 

a code segment for selectively failin g the IRP depending upon the 
requested-type of access. 

25. An apparatus for selectively establishing read-only access to a volume of 
a storage-device, the apparatus comprising: 

a memory in which is created the stack of device objects representing a 
storage-device, the stack including a filter device object (DO); 
filter driver means for 

assessing the type of access being requested via an input/output 
request packet (IRP) arriving at the filter DO, and 

selectively falling the IRP according to the requested-type of access. 
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